a few days ago I placed a sell order that was wiped out by this guy
http://www.blockscan.com/order.aspx?q=3336assuming that this troll will never pay, I'm not sure what happens in these cases.
If the buyer doesn't process a btcpay, what happens to the xcp placed in the orderbook?
Am I supposed to just wait or am I supposed to cancel my order (if it's possible)?
Wait for your order to expire naturally.
Lesson learned: set a shorter expiration time, or use fee_required. Until we get those upcoming "anti-troll" features currently in discussion.